058f4b20edfbd0d498e4e007f2e240152ef28924cdd40df22c8c5cd93f4332df

Sharing

Copy URL Twitter E-mail

General

Target

058f4b20edfbd0d498e4e007f2e240152ef28924cdd40df22c8c5cd93f4332df
Size

289KB
MD5

f37f37e945a0b89e66d9984df57ce644
SHA1

7e9435f647087639f2026930198912298b043c91
SHA256

058f4b20edfbd0d498e4e007f2e240152ef28924cdd40df22c8c5cd93f4332df
SHA512

7ce28edd98a1438ff5fc7decbea00bb17177b336c7ce75a983c468c72cb6787abc52aae0e8d3297d3fdc0305c11da87f5da946963c3121a6e7f52b60c1a68d30
SSDEEP

6144:Op6mIRtsr9K57JzhGRpgFIk4rKLR3y3AoQiGL1j6he+:Op6mIRurE7mju4rJAoDG5uhe+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
058f4b20edfbd0d498e4e007f2e240152ef28924cdd40df22c8c5cd93f4332df

Files

058f4b20edfbd0d498e4e007f2e240152ef28924cdd40df22c8c5cd93f4332df
.exe windows:5 windows x86 arch:x86

c0c9bfe5447f644f26c46a61394d83b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\zhanlue\haozip\bin\Win32\release\pdb\HaoZipLoader.pdb

Imports

imm32

ImmDisableIME

kernel32

LoadLibraryW
FreeLibrary
ExpandEnvironmentStringsW
WaitForSingleObject
GetPrivateProfileStringW
GetLastError
CreateProcessW
GetExitCodeProcess
GetFileAttributesW
GetModuleHandleW
GetCurrentProcess
GetVersionExW
LoadLibraryExW
FindFirstFileW
GetLongPathNameW
CreateFileW
GetFileAttributesExW
CreateMutexW
ReleaseMutex
Sleep
GetEnvironmentVariableW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetCurrentThreadId
OpenProcess
HeapAlloc
LocalFree
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LockResource
LoadResource
FindResourceW
lstrcmpiW
LoadLibraryA
FindNextFileW
FindClose
ReadFile
WriteFile
SetFilePointer
SetEndOfFile
GetFileSize
CreateDirectoryW
GetFullPathNameW
lstrlenW
RemoveDirectoryW
GetTempPathW
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
MoveFileExW
CopyFileW
GetTempFileNameW
MoveFileW
lstrcatW
lstrcpyW
GetFileSizeEx
GetCurrentProcessId
FormatMessageW
SetErrorMode
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WritePrivateProfileStringW
GetModuleFileNameW
GetProcAddress
GetSystemDefaultLangID
CloseHandle

user32

MessageBoxW
LoadStringW

advapi32

GetUserNameW

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation

ole32

CoTaskMemFree

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

__std_terminate
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_except_handler4_common
memset
_purecall
__CxxFrameHandler3
memmove
memcpy
wcsstr
wcschr

api-ms-win-crt-string-l1-1-0

_stricmp
wcsncpy
towlower
_wcsicmp
wcslen
towupper

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_invalid_parameter_noinfo_noreturn
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_controlfp_s
_register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf
__p__commode
_set_fmode

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
_callnewh
calloc
free

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s

api-ms-win-crt-math-l1-1-0

_except1
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c0c9bfe5447f644f26c46a61394d83b0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

imm32

kernel32

user32

advapi32

shell32

ole32

msvcp140

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 212KB - Virtual size: 211KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 17KB - Virtual size: 20KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 212KB - Virtual size: 211KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 17KB - Virtual size: 20KB

.reloc
Size: 12KB - Virtual size: 12KB